Tag Info

Hot answers tagged

19

Yes, bcrypt has a maximum password length. The original article contains this: the key argument is a secret encryption key, which can be a user-chosen password of up to 56 bytes (including a terminating zero byte when the key is an ASCII string). So one could infer a maximum input password length of 55 characters (not counting the terminating zero). ...


9

Yes, BCrypt has an upper limit of 72 characters. It's a limitation by the Blowfish cipher itself. One way to work around it is by using SHA-256 first and then BCrypt the result. In your case it would be something like hashpw(sha256('pass'), salt)


7

Edit: it so happens that the first version of the question was talking about Ken Thompson's classic essay, so my answer was about it, too. It would be a shame to delete it, so I leave it at the end. Now, for the "updated" question: we now speak of something completely different, which is about the easiness of "hiding a backdoor in plain sight", namely in ...


5

Yes, malware exists in all sorts of languages. Often, though, some of the most critical fiddly bits of many exploits are written not in C or C++, but rather directly in machine code, carefully assembled often by hand. This may be the only want to get the sizing and alignment correct for what you're trying to do. The distance from the "metal" is a matter of ...


4

Once an attacker already has access to the system it's already way too late. The main concern for not leaking the key is because it is often used as a seed for hashing and signing sessions. The idea is that your production SECRET_KEY needs to be completely different than your development or staging SECRET_KEY. You can actually randomly generate it every ...


4

Virtual machines work as sand boxes to keep bad things in, not bad things out. If the host is compromised, so are the containers running within it as the virtual machine has to call out to the host for many actions and the host has full awareness and control over the system running within it.


4

Short version: Shell scripts require more caution with untrusted input; there are inherent dangers. Shell scripts are not general purpose languages, and are probably unsuited for "parsing untrusted data over networks" All that said, shell scripts can do amazing amounts of things, and can do it securely with enough care. Should is a different matter, and ...


3

I don't think that the code you are marking is the one achieving to exploit the bug: s.send(struct.pack('>I',len(buff) )) What this line is doing is sending the length of the buffer he is going to send right behind in the proper endiannes (Big Endian or network endiannes). I believe that the exploit itself will have to do with the lengths of the ...


3

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell. There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when ...


3

You have a Web site; it is meant to provide pages to whoever asks for them. That's the whole point of a Web site. What sense would it make to refuse to send the page to some people ? Especially if the exclusion criterion is the User-Agent string, which is freely chosen by the client. Any individual with nefarious intentions can masquerade his software so ...


3

If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want. Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...


3

This functionality already exists in Nmap, in the pjl-ready-message NSE script. Here's an example usage: nmap -p 9100 --script pjl-ready-message --script-args pjl_ready_message="your message here" 192.0.2.0/24 The script already checks for a real PJL service before sending the command, so you probably don't have to check for OS fingerprint results.


2

How can I implement secure connection between client and my python server? I guess I could use SSH or SSL, but which one will be better suited for the job? And If I choose SSH then wouldn't it interfere with SSH login service I use to manage my (whole) server? If it is only you that will be connecting to the server, I would secure the whole process ...


2

As you ouline, due to the limitaiton of /etc/shadow access, at some level, your application will either have to access that file or access some other module/service which has access to that file. There is no avoiding it if you want a solution which uses locally managed user credentials (unless you totally roll your own, which I strongly recommend avoiding). ...


2

You might want to take a look at the Canari Framework (https://www.canariproject.com/4-3-transform-development-quick-start/). It's an awesomely simple transform development framework that let's you do some pretty rad things ;). UPDATE 1: Canari now has some additional support for complex field types. So far we've added datetime, timespan, color, and date. ...


2

When writing binary output data try instead using open('bomber.out', 'wb').write(data) I can't verify if this will help but it might be worth a try.


2

Your searches must have missed the GitHub repo, which is highlighted on w3af.org. Examples are all there.


2

As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...


2

The best way of dealing with this is to write a custom sqlmap tamper script. You can find examples in the tamper folder. In the script you'll want to make a request to whatever page is generating the random form parameter (or appending to a parameter's value); or if you can truly predict it every time, just have the tamper script generate it itself. So ...


2

Basically, the solution you're looking for is going to involve some sort of offline transfer. The two computers that are the endpoint nodes of your secure tunnel must be "introduced" to each other, exchanging some secret that will allow one side to initiate a connection in such a way that only the other node could understand it. While this shared secret ...


2

In general there are valid URL schemes that are dangerous. Most obviously javascript:, which as a pseudo-URL refers not to a new location, but to a command to execute on the current page. Allowing a javascript: URL to be added to your page means you have a cross-site scripting problem. There are also other scripting aliases (vbscript:, mocha: et al), as ...


2

The python script connects to the IP 82.94.242.254 on port 8123, authenticates using pass1 and pass2 and then start receiving commands from the C&C. The commands are DOWNLOAD, NIKTO, NMAP, PING, PINGFLOOD, SYNFLOOD and VERSION. Most of these will trigger the execution of a .sh script. From the names we can guess the kind of commands available, which are ...


2

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication. People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must ...


2

You can write a virus in any language. The condition is the OS vulnerability that is being exploited and the language tools that are available to take advantage of it. "High-level" languages are not 'further' from the OS kernel, but rather they are more abstracted from the kernel from the programmer's point of view. Even Python can access network sockets, ...


2

The Hearbleed security bug (CVE-2014-0160) affects only specific versions of OpenSSL, and nothing else. From OpenSSL Security Advisory [07 Apr 2014], on OpenSSL's web site: Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. So, to answer your question: It depends on whether OpenSSL is used on your system, ...


2

As mentioned by Valmiky Arquissandas, encrypted text is generally expected to be computationally indistinguishable from random data. Thus, the only publicly known efficient way to do something like check if a file is "not already encrypted by AES" is to run a randomness test. However, your application should use authenticated encryption anyway, and if it ...


2

In the FIPS publication you can see different annexes, in the Annex A: Approved Security Functions it says that AES, SHA-256 and SHA-512 are FIPS-140 compliance. In the FIPS-140 validated list however I can't see any python module. Therefore seems that there isn't a python module FIPS-140 compliance, so you can use whatever python cryptographic module want ...


1

I guess you are referring to ssltest.py that is circulating in the wild. The Client Hello was probably just copied from another packet capture. It is part of the SSL handshake: Client Server ClientHello --------> ServerHello ...


1

The address in your environment may have changed because the environment is different. You could look at the coredump to find out the correct address to use ( you don't have to use a nop sled then :) )


1

There are multiple benefits using https: More likely that firewalls will accept this traffic, rather than a random port. HTTPS encryption hides what is beeing sent over the network, so IDS/IPS systems will not see what is going on - given that there is no SSL termination (transparent). HTTPS will look more normal in firewall logs. It is not unexpected as ...



Only top voted, non community-wiki answers of a minimum length are eligible